diff --git a/AGENTS.md b/AGENTS.md
index 42cbb4f..0ca05db 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,6 +39,10 @@ All traffic goes through **raspen** (single entry point):
 ssh://git@git.home:2222/scoot/selfhosted2.git
 ```
 
+## Conventions
+
+- The machines `agge` and `raspen` require `sudo` for most commands. Do **not** attempt to execute commands requiring sudo via SSH — present the command to the user and let them run it manually.
+
 ## Password management
 
 See `.env.example` for required variables. Real `.env` lives on hector and a copy on agge (`chmod 600`). To rotate: generate with `openssl rand -base64 18`, update `.env`, run `ALTER USER` in the container.